Question

A healthcare company runs a SageMaker real-time endpoint inside a private VPC with no internet access, in accordance with strict compliance rules. The security team now wants to enable SageMaker Model Monitor to run scheduled data quality monitoring jobs. During the first scheduled run, the monitoring job fails because its processing container cannot reach the SageMaker service and Amazon S3 to read captured data and write reports. What is the MOST appropriate way to allow the monitoring job to run while keeping all traffic off the public internet?

Accepted Answer

Configure the monitoring schedule to run the processing job in the same VPC and subnets, and create interface VPC endpoints for SageMaker plus an S3 gateway VPC endpoint.

Answer

Attach an internet gateway to the VPC and add a public route so the monitoring container can reach the SageMaker and S3 public endpoints.

Answer

Disable network isolation on the endpoint and grant the monitoring job a NAT gateway route to the internet for S3 and SageMaker access.

Answer

Move the captured data to a public S3 bucket so the monitoring job can download it without any VPC networking changes.